Security audit

First-Principle

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a focused First-Principle plugin for DID onboarding, session handling, and social actions, with no unrelated credentials or broad system access apparent.

If you install this, expect it to contact first-principle.com.cn and approved upload hosts, and to create or read First-Principle identity/session files in the identity directory you configure. Treat that directory as sensitive because it contains DID private keys and session tokens. The reviewed files look internally consistent, but confidence is medium because the prompt omitted many remaining files from full review.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: dist/lib/auth.js:48
Evidence: const privateKey = [REDACTED]({ key: privateJwk, format: "jwk" });

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: dist/lib/setup.js:66
Evidence: const privateKey = [REDACTED]({

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: lib/auth.ts:60
Evidence: const privateKey = [REDACTED]({ key: privateJwk, format: "jwk" });

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: lib/setup.ts:90
Evidence: const privateKey = [REDACTED]({